analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://cartoonclassic.github.io/

Full analysis: https://app.any.run/tasks/017b103a-8c9a-4c05-b387-cd0e59e9a391
Verdict: Malicious activity
Analysis date: October 04, 2022, 21:45:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

08F305F57CBDC8085E2DC2EA3BC737DA

SHA1:

85E0E97EAD5E4412CFED424D3C8D2AF9455E5991

SHA256:

69300EC5A9F576AC4DAEBB217045CB8FDB3C39E2516D0C933C63CF81CB73A082

SSDEEP:

3:N8ZXRKQyJ+:2CP+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2564)

    • Checks supported languages

      • WinRAR.exe (PID: 3444)

    • Reads the computer name

      • WinRAR.exe (PID: 3444)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 2564)
      • iexplore.exe (PID: 2724)

    • Reads the computer name

      • iexplore.exe (PID: 2724)
      • iexplore.exe (PID: 2564)

    • Changes internet zones settings

      • iexplore.exe (PID: 2724)

    • Application launched itself

      • iexplore.exe (PID: 2724)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2564)
      • iexplore.exe (PID: 2724)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2564)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2564)
      • iexplore.exe (PID: 2724)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2724)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2724"C:\Program Files\Internet Explorer\iexplore.exe" "https://cartoonclassic.github.io/"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2564"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2724 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3444"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\Cartoon_Classic.zip"C:\Program Files\WinRAR\WinRAR.exe—iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
17 636
Read events
17 511
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
16
Text files
18
Unknown types
18

Dropped files

PID
Process
Filename
Type
2564iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04der
MD5:E1817D34D647D15C961327938AA58C4A
SHA256:CA2D2DB19D9A688484F592397EBC22270DC2B6F653C583B8DFDF27CFF24E0E07
2564iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:1BFD88C7061A28206A17F521DCCC4C45
SHA256:E8AC66C254915C35CAA6F1AFEDEFE5E4797224242A9E3D60EB368925C2F6F2E6
2564iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\0AYJYVR6.htmhtml
MD5:8BEC7EC4957FCBC619FE00D85C8C0DFE
SHA256:9DD6F0AEDB54B1C3BF82DF60FC4142F444D32F9D230D6BE371FEEC3B390D43A3
2564iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:8D0B18ACDB128088CD477B70EB24769B
SHA256:1604E28CFD2B93BB422911155840C3437838662434CB4A35F0309A04939F239B
2724iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442binary
MD5:6027EE3685017AF5E04E823C7B8FCFE1
SHA256:9898B3BA9A32D3F77AE8BA247B40D49978D4247BB370A734EA6B8CADFE25506B
2564iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_043C840D28CDD26D33370C4C34146D79der
MD5:E5E83AC13AAFAA8905EB522C4521A72F
SHA256:F01155BF27FBD113A7E78ED2DBE9710BB0352F1CA5AF71220D8C51EEAE730DD5
2564iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\main[1].jstext
MD5:5582E03D8BF450FB797C97D9813AE3F5
SHA256:72CA60625E69835E96CA9A27F89F6130111447259ADB1C7E7CCB58C6BB7865D9
2564iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:87F21489639558113EC48F562FB567AF
SHA256:F46D594F9BB9E592F827DF9FC3222F6DE1CA75F61F5A34759A29B9A9479706E0
2564iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:14B876F47F7342FF9E967F30AD868D4B
SHA256:CA707374AF9F295DFAADA6577DACEA61A07E20FECC6D5D1227926462B94A60A9
2564iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\style[1].csstext
MD5:B5C7C31A0F1B1C246B69AA975B3B72BC
SHA256:18DBC40CD5631C5B85E900B08D56337A073AE2E6947CBF727BA4C6F31241EB50
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
40
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2564
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
2724
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
2564
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
2564
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEA0ijpIftfb6cA%2FVTEnYrfQ%3D
US
der
279 b
whitelisted
2564
iexplore.exe
GET
200
216.58.212.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
2564
iexplore.exe
GET
200
216.58.212.131:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBJBetlj4ZeUEqggpI8HVMI%3D
US
der
471 b
whitelisted
2564
iexplore.exe
GET
200
216.58.212.131:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB%2Fvu3PmotRDEvKn%2FiRyWpo%3D
US
der
471 b
whitelisted
2724
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2564
iexplore.exe
GET
200
216.58.212.131:80
http://crl.pki.goog/gsr1/gsr1.crl
US
der
1.70 Kb
whitelisted
2564
iexplore.exe
GET
200
23.216.77.69:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?39d2d4bbd71fb2f9
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2564
iexplore.exe
23.216.77.69:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
suspicious
2564
iexplore.exe
172.64.103.24:443
code.iconify.design
CLOUDFLARENET
US
unknown
2564
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
2564
iexplore.exe
104.17.24.14:443
cdnjs.cloudflare.com
CLOUDFLARENET
—
suspicious
2564
iexplore.exe
185.199.111.153:443
cartoonclassic.github.io
FASTLY
US
shared
2564
iexplore.exe
162.159.133.232:443
media.discordapp.net
CLOUDFLARENET
—
shared
—
—
192.168.100.2:53
—
—
—
whitelisted
2724
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
2724
iexplore.exe
162.159.133.232:443
media.discordapp.net
CLOUDFLARENET
—
shared
2564
iexplore.exe
142.250.181.234:443
fonts.googleapis.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
cartoonclassic.github.io
  • 185.199.111.153
  • 185.199.110.153
  • 185.199.109.153
  • 185.199.108.153
malicious
www.microsoft.com
  • —
whitelisted
ctldl.windowsupdate.com
  • 23.216.77.69
  • 23.216.77.80
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
cdnjs.cloudflare.com
  • 104.17.24.14
  • 104.17.25.14
whitelisted
media.discordapp.net
  • 162.159.133.232
  • 162.159.130.232
  • 162.159.134.232
  • 162.159.128.232
  • 162.159.129.232
whitelisted
code.iconify.design
  • 172.64.103.24
  • 172.64.102.24
suspicious
cdn.jsdelivr.net
  • 104.16.85.20
  • 104.16.87.20
  • 104.16.89.20
  • 104.16.88.20
  • 104.16.86.20
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
2564
iexplore.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
2564
iexplore.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://cartoonclassic.github.io/